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1 Introduction (Abstract) 

In this paper we will present a proof of the consistency of Quine’s set theory 
“New Foundations” (hereinafter NF), so-called after the title of the 1937 
paper HU in which it was introduced. The strategy is to present a Fraenkel- 
Mostowski construction of a model of an extension of Zermelo set theory 
without choice whose consistency was shown to entail consistency of NF in 
our paper [5] of 1995. There is no need to refer to [5]: this paper presents a 
full (we think a better) account of considerations drawn from that paper. 
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2 The simple theory of types 

New Foundations is introduced as a modification of a simple typed theory 
of sets which we will call “the simple theory of types” and abbreviate TST 
(following the usage of Thomas Forster and others). 

Definition (the theory TST): TST is a first-order many-sorted theory 
with equality and membership as primitive relations and with sorts 
(referred to traditionally as “types”) indexed by the natural numbers. 
A variable may be written in the form x l to indicate that it has type 
i but this is not required; in any event each variable x has a natural 
number type type(‘a;’). In each atomic formula x = y, the types of x 
and y will be equal; in each atomic formula x G y the type of y will be 
the successor of the type of x. 

The axioms of TST are axioms of extensionality 

( Vxy.x = y (Vz.z GiOzG y)) 

for any variables x,y, z of appropriate types and axioms of comprehen¬ 
sion, the universal closures of all formulas of the form 

(3A.(\/x.x e A <*<!>)) 

for any variables x, A of appropriate types and formula <ft in which the 
variable A does not occur. 

Definition (set abstract notation): We define {x : 0} as the witness 
(unique by extensionality) to the truth of the comprehension axiom 

(3A.(\/x.x G A -H- </>)). 

For purposes of syntax, the type of {x : (j)} is the successor of the type 
of x (we allow {x : <f>} to appear in contexts (other than binders) where 
variables of the same type may appear). 

This completes the definition of TST. The resemblance to naive set theory 
is not an accident. This theory results by simplification of the type theory 
of the famous (20] of Russell and Whitehead in two steps. The predicativist 
scruples of [20] must first be abandoned, following Ramsey’s [T2j. Then it 
needs to be observed that the ordered pair can be defined as a set, a fact 
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not known to Whitehead and Russell, first revealed by Wiener in 1914 (f2U). 
Because Whitehead and Russell did not have a definition of the ordered 
pair as a set, the system of |20j has a far more complicated type system 
inhabited by arbitrarily heterogeneous types of n-ary relations. The explicit 
presentation of this simple theory only happens rather late (about 1930): 
Wang gives a nice discussion of the history in [T9] . 

The semantics of TST are straightforward (at least, the natural semantics 
are). Type 0 may be thought of as a collection of individuals. Type 1 is 
inhabited by sets of individuals, type 2 by sets of sets of individuals, and in 
general type n + 1 is inhabited by sets of type n objects. We do not call the 
type 0 individuals “atoms”: an atom is an object with no elements, and we 
do not discuss what elements individuals may or may not have. 

Definition (natural model of TST): A natural model of TST is deter¬ 
mined by a sequence of sets X t indexed by natural numbers % and 
bijective maps f, : X l+l —>- V(X Notice that the f/s witness the fact 
that \Xi\ = |'P*(Ao)| for each natural number i. The interpretation 
of a sentence in the language of TST in a natural model is obtained 
by replacing each variable of type i with a variable restricted to A* 
(bounding quantifiers binding variables of type i appropriately), leav¬ 
ing atomic formulas x l = y l unmodified and changing x l G y l+l to 
X G f/y i+1 ). 

When we say the natural model of TST with base set X 0 , we will be 
referring to the obvious natural model in which each /, is the identity 
map on X i+ \ = P 1+1 (A 0 ). We may refer to these as default natural 
models. 

Observations about natural models: It is straightforward to establish 

that 

1. The axioms translate to true sentences in any natural model. 

2. The first-order theory of any natural model is completely deter¬ 
mined by the cardinality of Ao. It is straightforward to construct 
an isomorphism between natural models with base types of the 
same size. 

It is usual to adjoin axioms of Infinity and Choice to TST. We do not 
do this here, and the precise form of such axioms does not concern us at the 
moment. 
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The theory TST n is defined in the same way as TST, except that the 
indices of the sorts are restricted to {0,..., n — 1}. A natural model of TST n 
is defined in the obvious way as a substructure of a natural model of TST. 

The interesting theory TNT (the “theory of negative types”) proposed 
by Hao Wang is defined as TST except that the sorts are indexed by the 
integers. TNT is readily shown to be consistent (any proof of a contradiction 
in TNT could be transformed to a proof of a contradiction in TST by raising 
types) and can be shown to have no natural models. 

We define a variant TST a with types indexed by more general ordinals. 

Parameter of the construction introduced: We fix a limit ordinal A for 

the rest of the paper. 

Definition (type index): A type index is defined as an ordinal less than 
A. For purposes of the basic result Con(NF), A = uj suffices, but for 
more general conclusions having more type indices available is useful. 

Definition (the theory TST A ) : TSTa is a first-order many-sorted theory 
with equality and membership as primitive relations and with sorts 
(referred to traditionally as “types”) indexed by the type indices. A 
variable may be written in the form x l to indicate that it has type i 
but this is not required; in any event each variable x has an associated 
type(‘x’) < A. In each atomic formula x = y, the types of x and y 
will be equal; in each atomic formula x € y the type of y will be the 
successor of the type of x. 

The axioms of TSTa are axioms of extensionality 

( \/xy.x — y •<->• (//z.z e x «->• z e y)) 

for any variables x. y, z of appropriate types and axioms of comprehen¬ 
sion, the universal closures of all formulas of the form 

(3A.(Vx.x G A •<->• (/))) 

for any variables x, A of appropriate types and formula <$> in which the 
variable A does not occur. 

In TSTa, the objects of successor types may be thought of as sets, and 
the objects of limit types as individuals of various types. Of course, there is 
not really any interest in TSTa as such without some relationship postulated 
between types whose indices do not have finite difference. 
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3 The definition of New Foundations 

The definition of New Foundations is motivated by a symmetry of TST. 

Definition (syntactical type-raising): Define a bijection x i—>• x + from 

variables in general to variables with positive type, with the type of x + 
being the successor of the type of x in all cases. Let 4> + be the result 
of replacing all variables in <f> with their images under this operation: 
c f> + is clearly well-formed if is. 

Observations about syntactical type-raising: If 0 is an axiom, so is </> + . 

If <j) is a theorem, so is (j) + . If {x : /} is a set abstract, so is {x + : 0 + }. 

This symmetry suggests that the world of TST resembles a hall of mirrors. 
Any theorem we can prove about any specific type we can also prove about 
all higher types; any object we construct as a set abstract in any type has 
precise analogues in all higher types. 

Quine suggested that we should not multiply theorems and entities un¬ 
necessarily: he proposed that the types should be identified and so all the 
analogous theorems and objects at different types should be recognized as 
being the same. This results in the following definition. 

Definition (the theory NF): NF is a first-order unsorted theory with equal¬ 
ity and membership as primitive relations. We suppose for formal con¬ 
venience that the variables of the language of TST are also variables 
of the language of NF (and are assigned the same natural number (or 
integer) types - though in the context of NF the types assigned to vari¬ 
ables do not indicate that they range over different sorts and do not 
restrict the ways in which formulas can be constructed). 

The axioms of TST are the axiom of extensionality 
( Vxy.x — y •<->• (f/z.z e x z e y)) 

and axioms of comprehension, the universal closures of all formulas of 
the form 

{3A.(\/x.x e A -H- </>)) 

for any formula (j) which is a well-formed formula of the language of 
TST (this is the only context in which the types of variables play a 
role) and in which the variable A does not occur. 
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Definition (set abstract notation): We define {x : cp} (for appropriate 
formulas <p) as the witness (unique by extensionality) to the truth of 
the comprehension axiom 

(3A(Vx.x (/)). 

This is not the way that the comprehension axiom of NF is usually pre¬ 
sented. It could make one uncomfortable to define an axiom scheme for one 
theory in terms of the language of another. So it is more usual to proceed 
as follows (if this approach is taken there is no need to associate a natural 
number or integer type with each variable). 

Definition: A formula <p of the language of NF is stratified iff there is a bi- 
jection a from variables to natural numbers (or integers), referred to as 
a stratification of (p, with the property that for each atomic subformula 
‘x = y 1 of (p we have cr(‘x’) = cr/y/ and for each atomic subformula 
‘x G y’ of (p we have cr(‘x’) + 1 = cr/y'). 

If we were to make more use of stratifications, we would not always 
be so careful about use and mention. Notice that a formula being 
stratified is exactly equivalent to the condition that it can be made a 
well-formed formula of the language of TST by an injective substitution 
of variables (if we provide as above that all variables of the language 
of TST are also variables of the language of NF). Of course, if we use 
the stratification criterion we do not need to assume that we inherit 
the variables of TST (and their types) in NF. 

Axiom scheme of stratified comprehension: We adopt as axioms all uni¬ 
versal closures of formulas 

(3A(Vx.x G A cp)) 

for any stratified formula (p in which the variable A does not occur. 

We discourage any philosophical weight being placed on the idea of strat¬ 
ification, and we in fact make no use of it whatsoever in this paper. We note 
that the axiom of stratified comprehension is equivalent to a finite conjunc¬ 
tion of its instances, so in fact a finite axiomatization of NF can be given that 
makes no mention of the concept of type at all. However, the very first thing 
one would do in such a treatment of NF is prove stratified comprehension as 
a meta-theorem. The standard reference for such a treatment is [3]. 
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4 Well-known results about New Foundations 

We cite some known results about NF. 

NF as a foundation of mathematics is as least as powerful as TST, since 
all reasoning in TST can be mirrored in NF. 

NF seems to have acquired a certain philosophical cachet, because it 
appears to allow the formation of large objects excluded from the familiar 
set theories (by which we mean Zermelo set theory and ZFC) by the “lim¬ 
itation of size” doctrine which underlies them. The universal set exists in 
NF. Cardinal numbers can be defined as equivalence classes of sets under 
equinumerousness. Ordinal numbers can be defined as equivalence classes of 
well-orderings under similarity. We think that this philosophical cachet is 
largely illusory. 

A consideration which one might take into account at this point is that 
we have not assumed Infinity. TST without Infinity is weaker than Peano 
arithmetic. TST with Infinity has the same strength as Zermelo set theory 
with separation restricted to A 0 formulas (Mac Lane set theory), which is a 
quite respectable level of mathematical strength. 

In [15], 1954, Specker proved that the Axiom of Choice is refutable in 
NF, which has the corollary that Infinity is a theorem of NF, so NF is at 
least as strong as Mac Lane set theory but with the substantial practical 
inconvenience for mathematics as usually practiced of refuting Choice. It was 
this result which cast in sharp relief the problem that a relative consistency 
proof for NF had never been produced, though the proofs of the known 
paradoxes do not go through. 

A positive result of Specker in ra. 1962, served to give some justification 
to Quine’s intuition in defining the theory, and indicated a path to take 
toward a relative consistency proof. 

Definition (ambiguity scheme): We define the Ambiguity Scheme for TST 
(and some other similar theories) as the collection of sentences of the 
form </ (j) + . 

Theorem (Specker): The following assertions are equivalent: 

1. NF is consistent. 

2. TST + Ambiguity is consistent 
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3. There is a model of TST with a “type shifting endomorphism”, 
that is, a map which sends each type i bijectively to type i + 1 
and commutes with the equality and membership relations of the 
model (it is also equivalent to assert that there is a model of TNT 
with a type shifting automorphism). 

The equivalence also applies to any extension of TST which is closed 
as a set of formulas under syntactical type-raising and the corresponding 
extension of NF, and to other theories similar to NF (such as the theories 
TSTU and NFU described in the next section). 
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5 Consistency of NFU 

In ffO], 1969, Jensen produced a very substantial positive result which en¬ 
tirely justihed Quine’s proposal of NF as an approach to foundations of math¬ 
ematics, with a slight adjustment of detail. 

Define TSTU as a theory with almost the same language as TST (it is 
convenient though not strictly necessary to add a primitive constant 0* +1 
in each positive type with the additional axioms ( Vx.x </_ 0 l+1 ) for x of each 
type i) with the same comprehension scheme as TST and with extensionality 
weakened to allow atoms in each positive type: 

Axiom (weak extensionality, for TSTU): 

(V xyz.z G x —> (x = y GG (Ww.w G x -B- w G y))) 


Definition (sethood, set abstracts for TSTU): Define set (a;) (x is a 
set) as holding iff x — 0 V (3 y.y G x ) [we are using polymorphism 
here: the type index to be applied to 0 is to be deduced from the type 
of x]. Define {re : <f)} as the witness to the appropriate comprehension 
axiom as above, with the qualification that if it has no elements it is 
to be taken to be 0. 

Definition (natural models of TSTU): It is convenient to reverse the 
direction of the functions /*. A natural model of TSTU is determined 
by a sequence of sets X\ indexed by natural numbers and a sequence 
of injections /* : 'P(X i ) —* AQ +1 . The interpretation of the language of 
TSTU in a natural model is as the interpretation of the language of 
TST in a natural model, except that x l G y l+1 is interpreted as (3 z.x 1 G 
z A fi(z) = y z+1 ). We interpret 0 i+1 as /*(0). It is straightforward to 
establish that the interpretations of the axioms of TSTU are true in a 
natural model of TSTU. 

Define NFU as the untyped theory with equality, membership and the 
empty set as primitive notions and with the axioms of weak extensionality, 
the scheme of stratified comprehension, and the axiom ( Vx.x / 0). 

Jensen’s proof rests on the curious feature that it is possible to skip types 
in a natural model of TSTU in a way that we now describe. For generality it 
is advantageous to first present natural models with types indexed by general 
ordinals less than A. 
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Definition (natural models of TSTUa): A natural model of TSTUa is 
determined by a sequence of sets X t indexed by ordinals i < A and 
a system of injections : V(X t ) —> Xj for each i < j < A. Inter¬ 
pretations of the language of TSTU in a natural model of TSTUa are 
provided with a strictly increasing sequence of type indices as 

a parameter: they are as the interpretation of the language of TST 
in a natural model, except that each variable x l of type i is to be in¬ 
terpreted as a variable x Si restricted to the set X Si and a membership 
formula x l G y l+1 is interpreted as (3 z.x Si G z A f Si ,s i+1 (z) — U Sj )- If is 
straightforward to establish that the axioms of TSTU have true inter¬ 
pretations in each such scheme. The special constant 0 ,+1 is interpreted 
as / Si ,s i+1 (0)- 

Theorem (Jensen): NFU is consistent. 

Proof of theorem: Clearly there are natural models of TSTUa for each A: 
such models are supported by any sequence X t indexed by i < A with 
each Xi at least as large as V(X/) for each j < i. Fix a natural model. 
Let E be any finite set of sentences of the language of TSTU. Let n 
be a strict upper bound on the type indices appearing in E. Define 
a partition of [A] n : the compartment into which an n-element subset 
A of A is placed is determined by the truth values of the sentences in 
E in the interpretation of TSTLI in the given natural model parame¬ 
terized by any sequence s such that the range of s\n is A (the truth 
values of interpretations of sentences in E are determined entirely by 
this restriction of s ). This partition of [A] n into no more than 2^ com¬ 
partments has an infinite homogeneous set H, by the Ramsey theorem, 
which includes the range of some strictly increasing sequence h of type 
indices. The interpretation of TSTU determined by h in the natural 
model satisfies (j) GG (fA for each (j) G E. Thus every finite subset of the 
Ambiguity Scheme is consistent with TSTLI, whence the entire Ambi¬ 
guity Scheme is consistent with TSTU, and by the results of Specker 
(the methods of whose proof apply as well to TSTLI and NFU as they 
do to TST and NF), NFLI is consistent. 

Corollary: NFLI is consistent with Infinity and Choice. It is also consistent 
with the negation of Infinity. 

Proof: If X (J is infinite, all interpretations in the natural model will satisfy 
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Infinity. If Choice holds in the metatheory, all interpretations in the 
natural model will satisfy Choice. If all X/s are finite (which is only 
possible if A = u>) the negation of Infinity will hold in the interpreted 
theory. 

Proof without appealing to Specker outlined: Suppose that < is a well¬ 
ordering of the union of the X/s. Add the relation < to the language 
of TSTU. with the same type rules as identity, and interpret x l < y 1 as 
X Si < y Si when interpreting TSTU using the sequence parameter s as 
above. We obtain as above a consistency proof for TSTU + Ambiguity 
+ existence of a primitive well-ordering < of each type (which can be 
mentioned in instances of ambiguity). The relation < can be used to 
define a Hilbert symbol: define (6x : </) as the <-least x such that q i>, or 
0 if there is no such x. Now construct a model of TSTU + Ambiguity 
+ primitive well-ordering < with the same theory consisting entirely of 
referents of Hilbert symbols (a term model). The Ambiguity Scheme 
justifies abandoning the distinction between a Hilbert symbol (Ox : </) 
and its type-raised version (0x + : (fi + ) in all cases and one obtains a 
model of NFU with a primitive well-ordering <. 

The consistency proof for NFU assures us that the usual paradoxes of 
set theory are indeed successfully avoided by NF, because NFU avoids them 
in exactly the same ways. This does not rule out NF falling prey to some 
other unsuspected paradox. Further, though this is not our business here, 
the consistency proof for NFU shows that NFU is a reasonable foundation for 
mathematics: NFU + Infinity + Choice is a reasonably fluent mathematical 
system with enough strength to handle almost all mathematics outside of 
technical set theory, and extensions of NFU with greater consistency strength 
are readily obtained from natural models of TSTa for larger ordinals A (see 
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6 Tangled type theories 

In [5], 1995, we pointed out that the method of proof of Jensen can be adapted 
to NF, establishing the equiconsistency of NF with a certain type theory. This 
does not immediately give a relative consistency proof for NF, because the 
type theory under consideration is very strange, and not obviously consistent. 

Definition (the theory TTT A ) : TTT A (tangled type theory with A types) 
is a first-order many-sorted theory with equality and membership as 
primitive relations and with sorts (referred to traditionally as “types”) 
indexed by the type indices. A variable may be written in the form x l 
to indicate that it has type i but this is not required; in any event each 
variable x has an associated type(‘x’) < A. In each atomic formula 
x = y, the types of x and y will be equal; in each atomic formula x e y 
the type of y will be strictly greater than the type of x. 

Let s be a strictly increasing sequence of type indices. Provide a map 
(x x s ) whose domain is the set of variables of the language of TST 
and whose restriction to type i variables a: is a bijection from the col¬ 
lection of type i variables in the language of TST to the collection of 
type Si variables in the language of TTT A . For each formula </> in the 
language of TST, define (p s as the result of replacing each variable x 
in cj) with x s . We oberve that (f) s will be a formula of the language of 
TTT a . 

The axioms of TTT A are exactly the formulas (f) s with s any strictly 
increasing sequence of type indices and 0 any axiom of TST. 

Theorem: TTT A is consistent iff NF is consistent. 

Proof of theorem: If NF is consistent, one gets a model of TTT A by using 
the model of NF (or if one prefers, disjoint copies of the model of NF 
indexed by A) to implement each type, and defining the membership 
relations of the model in the obvious way. 

Suppose that TTT A is consistent. Fix a model of TTT A . Let E be a 
finite set of sentences of the language of TST. Let n be a strict upper 
bound on the (natural number) type indices appearing in £. We define 
a partition of [A] n : the compartment into which an n-element subset 
A of A is placed is determined by the truth values of the sentences (j) s 
for 0 6 X for strictly increasing sequences s of type indices such that 
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the range of s\n is A. This partition of [A] n into no more than 2^ 
compartments has an infinite homogeneous set H which includes the 
range of a strictly increasing sequence h of type indices. The interpre¬ 
tation of TST obtained by assigning to each formula </> of the language 
of TST the truth value of (j) h in our model of tangled type theory will 
satisfy each instance <f> -H- </> + of Ambiguity for </> € E. It follows by 
compactness that the Ambiguity Scheme is consistent with TST. and 
so by the results of Specker that NF is consistent. 

Proof without appealing to Specker outlined: Suppose that < is a well¬ 
ordering of the union of the types of our model of tangled type theory 
(this is not an internal relation of the model in any sense). Add the 
relation symbol < to the language of TST. with the same type rules 
as identity, and transform atomic formulas x < y to X s < y s in the 
construction of formulas </ s . We obtain as above, using this extended 
language to define our partition, a consistency proof for TST + Ambi¬ 
guity + existence of a primitive relation < on each type (which can be 
mentioned in instances of ambiguity, but which cannot be mentioned in 
instances of comprehension) which is a linear order and a well-ordering 
in a suitable external sense (any definable nonempty class has a <- 
least element) and which can be used to define a Hilbert symbol: we 
can define ( 6x : </) as the <-least x such that (f), or 0 if there is no such 
x. Now construct a model of TST + Ambiguity + primitive “external 
well-ordering” < with the same theory consisting entirely of referents 
of Hilbert symbols (a term model). The Ambiguity Scheme justifies 
abandoning the distinction between a Hilbert symbol (Ox : (/) and its 
type-raised version ( 0x + : (j) + ) in all cases and one obtains a model of 
NF with a primitive external order <. 

Examination of our presentation of Jensen’s consistency proof for NFU 
should reveal that this is an adaptation of the same method to the case of 
NF. In fact, our “natural model of TSTUa” above can readily be understood 
as a model of TTTUa- 

It should also be clear that TTTa is an extremely strange theory. We 
cannot possibly construct a “natural model” of this theory, as each type is 
apparently intended to implement a “power set” of each lower type, and 
Cantor’s theorem precludes these being honest power sets. 
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6.1 to- and n-models from tangled type theory 

It is worth noting that the proof of the main result of this paper does not 
depend on this section: this section is included to indicate why the main 
result implies further that there is an w-mo del of NF. 

Jensen continued in his original paper [10] by showing that for any ordinal 
a there is an a-model of NFU. We show that under suitable conditions on 
the size of A and the existence of sets in a model of TTT\, this argument 
can be reproduced for NF. 

We quote the form of the Erdos-Rado theorem that Jensen uses: Let 5 
be an uncountable cardinal number such that 2 13 < 5 for f 3 < 5 (i.e., a strong 
limit cardinal). Then for each pair of cardinals /3, fj, < 5 and for each n > 1 
there exists a 7 < 5 such that for any partition / : [ 7 ]" —* /i there is a set 
X of size /3 such that / is constant on [X] n (X is a homogeneous set for the 
partition of size /3 ). 

Let A be a strong limit cardinal with cofinality greater than 2l“L Our 
types in TTT will be indexed by ordinals < A as usual. We make this 
stipulation about A only for this subsection. 

We assume the existence of a model of TTT^ in which each type contains 
a well-ordering of type a (from the standpoint of the metatheory as well 
as internally): our language will include names for the well-ordering on 
objects of each type (3 < A and names [<^] 7 for each 7 < a for the object 
of type j3 at position 7 in the order </. We adjoin similar symbols <* for 
i G N and [<*] 7 for 7 < a to the language of TST. We stipulate that in 
the construction of formulas (f) s , notations <* and [<*] 7 will be replaced by 
notations < s b) and [< s ^] 7 . A model of NF can then be constructed following 
the methods above in which a single relation < with the objects [<] 7 in its 
domain appears. However, the model of NF is obtained by an application of 
compactness: the order < obtained may not be an order of type cc or a well 
ordering at all from the standpoint of the metatheory, because it may have 
many nonstandard elements. To avoid this, we need to be more careful. 

Let E n be the collection of all sentences of the language of TST n extended 
as indicated above which begin with an existential quantifier restricted to 
the domain of an order < l . Let the partition determined by £ n make use 
not of the truth values of the formulas in E n , but of the indices 7 < a 
of the minimally indexed witnesses [<] 7 to the truth of each formula, or 
a if they are false. The Erdos-Rado Theorem in the form cited tells us 
that we can End homogeneous sets of any desired size less than A for this 
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partition, and moreover (because of the cofinality of A) we can find, for some 
fixed assignment of witnesses to each sentence of E n which is witnessed, 
homogeneous sets of any desired size which induce the fixed assignment of 
witnesses in the obvious sense. Note that each E n is of cardinality |a| and 
there are 2^ possible assignments of a witness < a to each sentence in E n 
(recalling that a signals the absence of a witness). This allows us to see 
that ambiguity of E n is consistent, and moreover consistent with standard 
values for witnesses to each of the formulas in E. We can then extend the 
determination of truth values and witnesses as many times as desired, because 
if we expand the set of formulas considered to E n+ i and partition (n + 1)- 
element sets of type indices instead of n-element sets, we can restrict our 
attention to a large enough set of type indices homogeneous for the previously 
given partition (and associated with fixed witnesses) to ensure that we can 
restrict it to get homogeneity for the partition determined by the larger set of 
formulas (and get an assignment of witnesses which occurs in arbitrarily large 
homogeneous sets, as at the previous stage). After we carry out this process 
for each n, we obtain a full description of a model of TST + Ambiguity 
with standard witnesses for each existentially quantified statement over the 
domain of a special well-ordering of type a. We can reproduce our Hilbert 
symbol trick (add a predicate representing a well-ordering of our model of 
TTT to the language as above) to pass to a model of NF with the same 
characteristics. 
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7 Tangled webs of cardinals 

In this section, we replace consideration of the weird type theory TTTy with 
consideration of a (still weird) extension of ordinary set theory (Mac Lane 
set theory, Zermelo set theory or ZFC) whose consistency is shown to imply 
the consistency of NF. We are working in set theory without Choice. We 
note without going into details that we will use Scott’s definition of cardinal 
number, which works for cardinalities of non-well-orderable sets. There is 
a chain of reasoning in tangled type theory which motivates the details of 
this definition, but it is better not to present any reasoning in tangled type 
theory if it can be avoided. 

Definition (extended type index, operations on extended type indices) 

We define an extended type index as a nonempty finite subset of A. For 
any extended type index A, we define A 0 as A, Ai as A\ {min(A)} and 
A n+ i as (A n )i when this is defined. 

Definition (tangled web of cardinals): A tangled web of cardinals is a 
function r from extended type indices to cardinals with the following 
properties: 

naturality: For each A with \A\ > 2, 2 t(a > = r(A i). 

elementarity: For each A with \A\ > n, the first-order theory of the 
natural model of TST n with base type t(A) is completely deter¬ 
mined by the set A \ A n of the smallest n elements of AJU 

Theorem: If there is a tangled web of cardinals, NF is consistent. 

Proof of theorem: Suppose that we are given a tangled web of cardinals 
r. Let £ be a finite set of sentences of the language of TST. Let n be 
a strict upper bound on the natural number type indices appearing in 
£. Define a partition of [A] n : the compartment in which an n-element 
set A is placed is determined by the truth values of the sentences in £ 
in the natural model of TST n with base type of size 

1 We could equally well make the condition |A| > n, which would simplify the proof 
immediately below noticeably, but this would not reflect the situation in the actual con¬ 
struction of a tangled web in the next section. 
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t(A U {max(A) + 1})0 This partition of [A] n into no more than 2^ 
compartments has a homogeneous set H of size n + 2. The natural 
model of TST with base type r(H) satisfies all instances 4> -tA (j) + of 
Ambiguity for <f> G £: type 1 of this model is of size 2 t( ' H ' 1 = t{H/) and 
the theory of the natural models of TST with base type t(H i) decides 
the sentences in £ in the same way that the theory of the natural 
models of r(H) decides them by homogeneity of H for the indicated 
partition and the fact that the first order theory of a model of TST n 
with base type of size any t(B) with \B\ > n is determined by the 
smallest n elements of B. Thus any finite subset of the Ambiguity 
Scheme is consistent with TST, so TST + Ambiguity is consistent by 
compactness, so NF is consistent by the results of Specker. 

There is no converse result: NF does not directly prove the existence of 
tangled webs. An cu-model of NF will contain arbitrarily large concrete finite 
fragments of tangled webs. 

The existence of a tangled web is inconsistent with Choice, ft should be 
evident that if Choice held in the ambient set theory in which the tangled 
web is constructed, Choice would hold in the model of NF constructed by 
this procedure, which is impossible by the results of Specker. 


2 Having to add one element artificially to A here reflects our decision to require |A| > 
n in the elementarity condition, which is dictated by the characteristics of the actual 
construction of a tangled web in the next section. 
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8 The main construction 

The working set theory of the construction is ZFA (with choice). We will 
carry out a Fraenkel-Mostowski construction to obtain a class model of ZFA 
(without choice) in which there is a tangled web of cardinals. 

cardinal parameters of the construction: We continue to use the pre¬ 
viously fixed limit ordinal A as a parameter. Define A\ as A\ {min(A)} 
where A is a nonempty finite subset of A. Define A 0 as A and A n+ i as 
(A n )i where this is defined. Define B A as holding iff A and B are 
distinct, A C B and all elements of B \ A are less than all elements of 
A; B<tlA means B <C A V B — A. We refer to finite subsets of A as 
clan indices for reasons which will become evident. 

Let k be a regular uncountable ordinal, fixed for the rest of the paper. 
We refer to all sets of cardinality < n as small and all other sets as 
large. 

Let /x be a strong limit cardinal, fixed for the rest of the paper, such 
that /i > |A|, /x > n, and the cofinality of g is > k. 

the extent of the atoms described: For each finite subset A of A, pro¬ 
vide a collection of atoms clan[A] of cardinality /x. If A / B } clan[A] 
and clan[L>] are disjoint. We call these sets clans. We provide two 
other collections of atoms of size p, disjoint from the clans and from 
each other, called parents[0] and junk. The elements of the clans will 
be called regular atoms and the elements of the other two sets will be 
called irregular atoms. 

our strategy for obtaining a tangled web indicated in advance: The 

aim of the FM construction is to create the following situation. We use 
the notation V/X) for the collection of symmetric subsets of a heredi¬ 
tarily symmetric set A". [We haven’t said yet what the group and filter 
are which define the FM construction - we will explain this in due 
course.] 

We consider the default natural models in the FM interpretation with 
base types clan[A], The cardinality of 'P” +2 (clan[A]) in terms of the 
FM interpretation is intended to be determined by A n where |A| > n: 
|P" +2 (clan[A])| = |'P 2 (clan[A n ])| will hold in the FM interpretation. 
(The clans will be seen directly to be hereditarily symmetric). 
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The (default) natural models of TST„ in the FM interpretation with 
bottom types P 2 (clan[A]) and P 2 (clan [B]) respectively are intended 
to be isomorphic in the ground ZFA (not in the FM interpretation: the 
maps witnessing this fact will not be symmetric) if A \ A n = B \ B n 
(where |A|, \ B\ > n ). This implies that they have the same first-order 
theory as models of TST n . 

Note that if these conditions are achieved, the map r sending nonempty 
A to the FM interpretation’s cardinality of P 2 (clan[A]) is a tangled 
web (in the FM interpretation) and the consistency of NF is established. 

These effects are to be achieved by careful design of the permutation 
group and filter generating the FM interpretation. 

litter, near-litters, and local cardinals introduced: For each of the clans 
clan[A] select a partition of clan[A] into sets of size k. We call this 
partition (a set of subsets of clan[A]) litters [A], We call the elements 
of these partitions litters. We call the sets litters [A] themselves lit¬ 
ter partitions if we have occasion to allude to them: each litter is an 
element of a litter partition of a clan. 

For each clan index A and for each L £ litters [A], define [L\, the 
local cardinal of L, as the collection of subsets of clan[A] with small 
symmetric difference from L. 

We refer to elements of local cardinals as near-litters . The local cardinal 
[N] of a near-litter N is defined as the local cardinal to which N belongs 
as an element. 

For any near-litter N, there is a unique litter N° such that NAN° is 
small: we refer to the elements of N AN° as the anomalies of N. 

the global parent function introduced: We will construct a function II 
whose domain is the set of all local cardinals (in all clans). This map 
will have the property that for each L £ litters [A], 7r 2 (n([L])) = A 
(among many other properties introduced in the course of its specifi¬ 
cation below). 

We will refer to 7 Ti(II([L])) as the parent of L (and of [L] and of any 
other near litter N belonging to [L\ = [iV]). The parent of a litter may 

3 It will be seen to be true in the FM interpretation that subsets of clans belong to the 
same local cardinal iff they have the same cardinality. 



Version of 1/2/2017 3:30 PM Boise time: version to be submitted 


21 


be a set or atom. 

The set 7Ti “n“(dom(II) ft P 2 (clan[A])) of all parents of litters included 
in clan [A] will be called the parent set of cl an [A] and denoted by 
parents [A], 

We will construct a sequence of approximations II Q and II* (a < A) 
to the eventual global parent function II = II a, and it should be noted 
that notions defined in terms of II have preliminary versions relative 
to these approximations. The domain of each of these approximations 
II Q and will be the set of local cardinals of litters included in clans 
clan[Al] for which the maximum of A is less than a or A is empty. We 
will use the notation 11^ to refer to n a or II* when we do not care 
which of these approximations we are referring to. 

In particular, it is useful to note that any IIq, which assigns a parent to 
a given near-litter will assign the same parent to it that II does, and 
any n Q which assigns a parent set to any given clan[Al] will assign the 
same parent set to it that II does. This will be evident when we see 
basic features of the system of approximations. This is not quite true 
for the other approximations II*, as we will see. 

allowable permutations introduced: The action of any permutation p 
on a set of atoms S is extended to all sets X whose transitive closure 
does not contain any atom not in S by the rule p(X) = p u X for any 
set X. 

The permutations we use to define the FM interpretation, which we 
call allowable permutations , are exactly those whose action extended 
to sets fixes II (and which fix any atoms not in the transitive closure of 
II). The allowable permutations in terms of any approximation 11^ are 
similarly those which fix II^ (and atoms not in its transitive closure). 
We are generally indifferent to what an allowable permutation does 
outside the transitive closure of the relevant parent function, but we 
declare that it fixes those atoms for precision. 

It is straightforward to see that the allowable permutations must fix 
clans and fix parent sets (where the clans and parent sets are included 
in the transitive closure of the parent function used). Suppose that 
p is a permutation which fixes 11^ and clan[A] is a clan included in 
the transitive closure of 11^. Suppose that L is a litter included in 



Version of 1/2/2017 3:30 PM Boise time: version to be submitted 


22 


clan [A]. We know that 7^(11^ ([-£/]) = A, from which it follows that 
7t 2 (n^ 1 ^(p([L])) = p(A) = A (because A is a pure set), so p([L]) C 
P(clan[A]). From this it is clear that p(clan[A]) C clan[A], and the 
same argument applied to p~ l shows that p(clan[kL]) = clan[kl]. The 
argument showing that parents [A] is fixed by p is very similar. 

It is useful to note that an allowable permutation p sends any litter L 
with parent p to a near-litter N with parent p(p) (not necessarily to 
the litter with parent p(p): a small collection of atoms may be mapped 
into or out of N from unexpected litters). 

varieties of atoms: We recall that the atoms in the clans are called reg¬ 
ular atoms. We stipulate that all irregular atoms which occur in the 
transitive closure of II (or of any IlL 1 '*) are parents of litters and do not 
occur in the transitive closures of any parents of litters which are sets 
(we will see that this stipulation holds in all the approximations to II 
that we consider when we give concrete descriptions of them). 

support sets, supports of objects, symmetry: We define a support set 
as a small set of atoms and near-litters in which distinct near-litter 
elements are disjoint. We say that an object x has support S iff every 
allowable permutation p such that (Vs G S : p(s) = s) also satisfies 
p(x) = x. We say that an object is symmetric iff it has a support. 
We say that an object is hereditarily symmetric iff it is symmetric 
and either it is an atom or all elements of its transitive closure are 
symmetric. Note that it is obvious that any object with a support has 
a support in which all near-litter elements are actually litters: if S is 
a support set, the set S° consisting of all atoms in S, all litters N° for 
N E S, and all elements of NAN° for IV e S is a support set and is a 
support for any object for which S is a support. 

For any hereditarily symmetric set X, we define V/X) as the set of all 
hereditarily symmetric subsets of X, which we may call the symmetric 
power set of X (relative to a 11^ understood in the context). 

Note that regular atoms are symmetric with support their own single- 
ton, and irregular atoms are symmetric with support the singleton of 
any litter of which they are parent. 

By standard considerations, the hereditarily symmetric sets and the 
atoms make up a class model of ZFA, which we will refer to as “the 
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FM interpretation 1 ', while referring to the ambient ZFA in which we 
started as “the ground interpretation”. 

Of course these notions depend on a particular choice of parent function 
as a parameter. A support in terms of ff^ will have all its elements 
atoms and near-litters in the transitive closure of Tf^ \ 

FM interpretations in general: We insert a summary of considerations 
about FM interpretations in general, taken (and slightly adapted) from 

Let G be a group of permutations of the atoms. Let F be a nonempty 
subset of the collection of subgroups of G with the following properties: 

1. The subset F contains all subgroups J of G such that for some 

H e r, H c j. 

2. The subset F includes all subgroups fj C of G where C C F and 
C is small [smallness being defined in terms of the parameter k 
already introduced above]. 

3. For each H G T and each n e G, it is also the case that e 

r. 

4. For each atom a, f ixc(a) G T, where f ixa(a) is the set of elements 
of G which fix a. 

A nonempty F satisfying the first three conditions is what is called a 
K-conrplete normal filter on G. 

We call a set A F -symmetric iff the group of permutations in G fixing 
A belongs to T. The major theorem which we use but do not prove 
here is the assertion that the class of hereditarily F -symmetric objects 
(including all the atoms) is a class model of ZFA (usually not satisfying 
Choice). The assumption that the filter is K-conrplete is not needed for 
the theorem (“finite” usually appears instead of “small”), but it does 
hold in our construction. 

Details of our FM interpretation: We let G be the group of allowable 
permutations. 

For each support set S we define Gs as the subgroup of G consisting 
of permutations which fix each element of S. 
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We define the filter T as the set of subgroups H of G which extend 
subgroups Gs■ The only point which requires special comment in the 
verification that T is a normal filter is the normality condition: it is 
straightforward to establish that if 7r G G and G s C if 6 T, then 
Gtt(S) C ttHtt 1 , establishing normality. 

Note that an FM interpretation is obtained in this way in terms of each 

TIq; • 

small subsets of the domain of the FM interpretation: It should be 

evident that any set of cardinality < k of hereditarily symmetric sets is 
hereditarily symmetric: choose a support for each element of the small 
set, and the union of the chosen supports of the elements of the set can 
serve as a support for the set (mod a technical point: assume that all 
near-litters in the supports chosen for the elements are litters, so that 
the union can be relied on to be a support set). 

the intended description of parent sets: As already noted, the set parents [0] 

is a set of irregular atoms of size yU. 

We intend that for each nonempty A, 

parents [A] = clan[Ai] U U 'p\B\-\ A \+ 1 (clan. [B]) 

B^A 


will hold. 

As contemplation of this formula may suggest to the reader, it takes 
work to show that the intention just expressed is possible to realize. 

The superscript in the notation v [ B ' ^ +1 (clan[.B]) indicates finite it¬ 
eration of the symmetric power set operation. 

construction of the global parent function starts: We will construct II 
in stages. For each a, we construct a function which will eventually 
be seen to be the restriction of II to local cardinals of litters in clans 
clan[A] with A empty or max(A) < a, which we call I1 Q . There will be 
other intermediate approximations II* where a is a successor ordinal. 

Note that the relationship between I1 Q and II which is projected will 
ensure that where I1 Q assigns parents to near-litters or parent sets to 
clans, II will assign the same parents and parent sets. 
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the zero stage: The case a = 0 is straightforward: we fix a bijection from 
the set of local cardinals of elements of litters[0] to parents[0] x {0} 
as ff 0 : we have already chosen these sets and we know them to be of 
the same cardinality ji. 

inductive hypotheses: At any stage a, we assume that we have already 
constructed Bp for each j3 < a and that for each (3 < 7 < a we have 
Bp C ILy, and that the formulas for parent sets given above hold for 
each Bp with ft < a for clans clan [A] with the maximum of A less 
than (3 (with the symmetric power set V * being defined in terms of 
allowable permutations defined in terms of Bp instead of the full ff not 
yet defined). 

We have further inductive hypotheses needed to drive the construction: 
here we state these and verify that they hold at the basis (where there 
is in fact anything to prove at the basis). 

1. For any natural number n, 'P”(clan[A]) is the same set as defined 
in terms of any two fig, II 7 with max(A) < (3 < 7 < a. 

2. For A, B nonempty finite subsets of A and 0 < n < \A\ and 
0 < n < \B\, there is an external isomorphism (in the ground in¬ 
terpretation of ZFA rather than the FM interpretation: the func¬ 
tion realizing the isomorphism is not symmetric) between the de¬ 
fault natural models of TST n+2 in the FM interpretation with 
base types clan[A] and clan[F>] and top types 'P” + 1 (clan[A]) 
and 'P” + 1 (clan[i?]), respectively, if A \ A n = B \ B n - this be¬ 
ing asserted in terms of each Bp with (3 < a, for each A, B with 
maximum less than f3. 

3. A locally small bijection is defined as a bijection whose domain 
and range are the same set of atoms and which sends any atom in 
its domain which belongs to a clan to an atom in the same clan 
and sends irregular atoms to irregular atoms, and whose domain 
has small intersection with each litter (the domain may contain 
none, some, or all of the irregular atoms). 

We say that a regular atom x belonging to a litter L is an exception 
of an allowable permutation p iff p(x) / p(L)°. (recall that for any 
near-litter N, N° is defined as the litter with small symmetric 
difference from N). 
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We stipulate as an inductive hypothesis that any locally small 
Injection po extends to an allowable permutation p, with no ex¬ 
ceptions other than elements of the domain of the locally small 
Injection p 0 , with all concepts being defined in terms of any ap¬ 
propriate for /3 < a (/ 3 must dominate the indices of the clans 
represented in the domain of po). We call this condition the ex¬ 
tension property. We say that such an allowable permutation p is 
a substitution extension of the locally small Injection p 0 . 

We verify that the extension property holds at the basis a = 0. 
Let po be a Injection on a set of atoms A included in parents[0] U 
clan[0], the set A having small intersection with each litter in 
clan[0], with the further conditions that po“parents[0] C parents [0] 
and p o “clan[0] C clan[0]. Extend po (giving the new map the 
same name) to act as the identity on parents[0] \ A For each lit¬ 
ter L, find the litter M such that 7 Ti(II 0 ([M])) = p 0 ( 7 ri(n 0 ([L])). 
Select a Injection p^ from L\dom(p 0 ) to M\dom(p 0 ). The desired 
allowable permutation is the union of po and all the maps p^: it 
is clearly allowable and has no exceptions other than elements of 
the domain of p 0 . 

4. A strong support set is defined as a support set S on which there 
is a (strict) well-ordering <g under which any regular atom x in S 
is preceded in <$ by the near-litter in S which contains x. if there 
is one (there is at most one such near-litter because distinct near¬ 
litter elements of a support set are disjoint), and which satisfies 
the condition that if the parent p of any near-litter N in S belongs 
to a set 7 7n+1 (clan[£>]), then p has the set 

{x : x <s N A (z3G'<A/i„ : x G clan((7) V x G litters[C])} 

as a (strong) support, and if the parent of a near-litter N in S is 
an atom x, the atom x either precedes N in <5 or does not belong 
to S [the latter must of course be the case if x is irregular]. 

We introduce the notation A 7 for the element sg 5 such that the 
restriction of <5 to {u : u <g s} has order type 7 . 

An extended strong support set has the further properties that 
every near-litter belonging to the support set is a litter and every 
atom in the support belongs to a litter in the support, and every 
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regular atom which is the parent of a litter in the support belongs 
to the support. 

We stipulate as an inductive hypothesis that every regular atom 
has an extended strong support (in terms of fl^ for fd < a). From 
this it is straightforward to establish that any support set can 
be extended to a strong support set (and indeed to an extended 
strong support set), and so every object with a support has an 
(extended) strong support. It is obvious that each regular atom 
in the transitive closure of n 0 has an extended strong support in 
terms of n 0 , whose elements are the atom itself and the litter to 
which it belongs (whose parent is an irregular atom). 

5. Each element of "P” +1 (clan [B]) [for n < |L>|] has a strong sup¬ 
port all of whose elements belong to clans clan(C') and litter sets 
litters(C') such that C<VB n . We call such a support a relevant 
support (or relevant strong support for emphasis). We further 
stipulate that a relevant support of an element of V w (a hereditar¬ 
ily finite pure set) is empty. The motive for this last condition is 
that hereditarily finite pure sets are the only sets which can belong 
to more than one set of the form V n (clan[B]): we do not want 
their relevant supports to contain information about them which 
is tied to a specific set of this form, and since they are invariant 
there is no reason to allow this. 

This obviously holds at the basis, where every support can be 
supplied with an order that makes it strong and every element 
of any support is in clan[0] or litters[ 0 ], so every element of 
"P(clan[0]) (the only iterated power set to be considered at this 
stage) has the desired property. 

6 . This clause does not state a new inductive hypothesis, but points 
out corollaries of the extension property and the existence of ex¬ 
tended strong supports. The general intention of this subsection 
is to clarify the extent to which allowable permutations act freely 
on general objects. The extension property tells us that they act 
quite freely on atoms, but since objects also have near-litters in 
their supports, whose parents may be sets, the degree of freedom 
of action on general objects requires clarification. 

(a) Let S and T be strong supports with orders <s and <t, re¬ 
spectively. We give a set of conditions equivalent to existence 
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of an allowable permutation mapping <5 to <t- 

i. For each appropriate 7 and clan index C, S 1 G clan[C] -B- 
T 7 G clan[C] and S 7 C clan[C] GG T 7 C clanfC 1 ] 

ii. For each appropriate 7 , 6, Sj G Sg iff T 7 G Tg. 

iii. For each appropriate 7 , 5, the atom S y is the parent of the 
litter Sg iff the atom T 7 is the parent of the litter Tg. 

iv. For each appropriate 7 , S y has set parent iff T 7 has set 
parent, and under this condition there is an allowable per¬ 
mutation mapping the initial segment of <5 with order 
type 7 to the initial segment of <t with order type 7 , 
and any such map sends the parent of S~, to the parent of 
T 7 (if any such map does this, all such maps do, because 
they agree on a support of the parent of ,S' 7 ). 

That these conditions hold if <t is the image of <5 under an 
allowable permutation is evident. 

We establish the converse using the extension property. 

Let x be the common order type of <5 and <t- 
We indicate how to construct, for each 7 < x, a locally small 
bijection p q with suitable properties, by recursion. For 7 < 
h < x we will have p(j C pg. The inductive hypotheses of the 
recursion are that for any substitution extension p 7 of pg and 
any 5 < 7 , we have p^^Sg) = Tg. 

i. For A < x limit, p^ is the union of all pg for 7 < A. 

ii. For each 7 such that is an atom or a litter with par¬ 
ent an atom, we will have pg +1 a locally small bijection 
extending pg U {(S/ T/)}. where Si f is defined as S 1 if ,S 7 
is an atom and otherwise as the parent of S^, and T 7 is 
defined similarly [an at most countably infinite set of ad¬ 
ditional values may be required to preserve the fact that 
the map is a bijection with the same set as domain and 
range: these should not be elements of S or T or parents 
of elements of S or T, and if such an additional element 
belongs to an Sg it must be mapped to an element of Tg]. 
ft is immediate that p 7 + 1 (5' 7 ) = T 7 for any substitution 
extension p 7+1 of Pg +1 . 

iii. For each 7 such that S 1 is a near-litter with parent a set, 
note that a substitution extension p 7 of pg will map the 
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parent of S-, to the parent of T 7 because it acts correctly 
on each element of a support of S' 7 . We extend pi to pl +1 
by the following procedure: associate with each anomaly 
s of S-y (not in S or in the domain of p/) a sequence 
of atoms Si with s 0 = s and each other s* in S° and 
with each anomaly t of T 7 (not in T or in the domain 
of pi) associate a sequence of atoms t, with t 0 = t and 
each other L in T°, and further for each anomaly s of 
S. y not in S provide a sequence s' of atoms in T° and 
for each anomaly t of T 7 not in T provide a sequence 
t! i of atoms in S°, all of these sequences being injective 
and the ranges of all these sequences being disjoint from 
each other and from S and T and from the domain of 
Po : Po +1 i s a locally small bijection which extends pi and 
contains all pairs (sj,s') and all pairs {t/U) [as noted 
above, the additional values added to preserve the fact 
that the map is a bijection with the same set as domain 
and range should not be in S, T, or be parents of elements 
of S or T and if such an additional element belongs to 
an Ss it must be mapped to an element of T $; only a 
small collection of such values are needed (no more than 
countably many values per explicitly described value, to 
fill out orbits in Pq + 1 )]. This causes the desired condition 
p 7 + 1 ( 5 ' 7 ) — Jt, to hold for any substitution extension p 7+1 
of pl +1 . 

Each pi is clearly a locally small bijection, and it should be 
evident that a substitution extension of pi will map each S 1 
to Ty and so send <s to <t as desired. 

It is also worth noting that the argument here shows that 
if S and T are strong supports with orders <5 and <t of 
limit order type in which it is possible for each pair of proper 
initial segments S', T' in the given order on S, T respectively 
of the same length (with restricted orders < 5 /, <t>) to find an 
allowable permutation p' such that p'(<s>) = p{<T')i we can 
find an allowable permutation p such that p(<s) = p(<t)- 
(b) Let po be a locally small bijection whose domain includes all 
irregular atoms. Using a nL l) for (3 < a, large enough to 
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handle the domain of p 0 , choose for each pair of litters L, M 
which are in the same clan a Injection Pl,m from L \ dom(po) 
to M \ dom(po). Then p 0 extends to a unique allowable per¬ 
mutation p which also extends Pl, p {l)° for each L. 

We prove this by presenting a procedure for computing a func¬ 
tion p for each regular atom or litter x and then arguing that 
the action of p on atoms must determine the unique allowable 
permutation with the indicated properties. 

We choose a strict well-ordering < a n of all regular atoms and 
litters with the property that the weak segment 

{y ■ V <aii x V y = x} 

contains an extended strong support of x for each regular 
atom or litter x (on which the order used agrees with < a ii). 
Such a well-ordering clearly exists. Segments in this order fail 
to be extended strong supports only by being too large. 

We fix a regular atom or litter x and assume that the value 
of p(y) has been computed for each element y of {y : y < all 
x}. It is also an inductive hypothesis that p is not assigned 
exceptions not in the domain of po; this is readily seen to be 
preserved by the procedure described below. 

If x is a regular atom, then it either belongs to the domain of 
Po, in which case p{x) is defined as p 0 (x) [we can regard these 
assignments of values as made immediately at the outset], or 
it does not belong to the domain of po: in this case it belongs 
to a litter L < a n x. By hypothesis of the recursion, p(L) has 
been computed already, and we define p(x) as Pl, p (l)°(x). 

If x is a litter L, then it has a parent p\ once we have computed 
a value p*(p) [how we do this is described just below], we find 
the litter M with parent p*(p) included in the same clan as L 
and compute p(L) as po“TU Pl,m“T. To avoid mystification, 
we point out that p*(p) will be seen in the end to be just p(p) 
in the usual sense, but we cannot presume this during the 
recursion. 

We have to describe the computation of p* (p). If p is an irreg¬ 
ular atom, we define p*(p) as po(p). If p is a regular atom, we 
define p*(p) as p(p), which we have by hypothesis of the recur¬ 
sion already computed. If p is a set, it has an extended strong 
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support S all of whose elements are < a n x, with <5 a restric¬ 
tion of < a ii. We have by hypothesis of the recursion already 
computed p at all values in S. We construct a substitution 
extension p' of a locally small Injection extending the union 
of the restriction of p to atoms in S and the map p 0 > with 
a further condition: some additional values p/z) may have 
to be assigned to preserve the condition that a locally small 
bijection is a bijection with domain and range the same set: 
for any litter q in S, we must preserve z G q -B- p'(z) G p(q), 
avoiding creation of additional exceptions of p' or images un¬ 
der p' of exceptions of p' belonging to litters in S. Note that 
any exception of p' which either belongs to a litter in S or 
is mapped into a litter in S must be a value at which p has 
already been defined. We define p*(p) as p/p). There are 
things that need to be verified to ensure that this works. We 
note that each litter q in S satisfies p/q) = p(q); if this were 
not the case, there would be a < a ii-first such q, to which we 
confine our attention: the parent of q clearly has the same 
image under p' that it does under p, since elements of a sup¬ 
port for q included in S satisfy this condition: for p(q) to be 
distinct from p/q), one of the following things must happen: 

i. an element r of q must satisfy p/r) / p{q). If p/r) G 
p(q)°, then p _ 1 (p'(r)) is an exception of p, so belongs to 
the domain of p 0 , so r itself is in the domain of p 0 , so 
p(r) = p/r), a contradiction. If p/r) / p(q)°, then r is an 
exception of p' , so p(r) is already defined so as to agree 
with p/r), a contradiction. 

ii. an r / q must satisfy p/r) G p(q). If p/r) G p(q)°, then 
r is an exception of p', so p(r) has already been defined 
as p/r), a contradiction. If p/r) / p(g)°, then p _ 1 (p'(r)) 
is an exception of p, and so belongs to the domain of p 0 , 
and so r belongs to the domain of p 0 , and p(r) = p/r) 
must hold, a contradiction. 

This establishes that any particular choice of extended strong 
support S for x from the < a n-segment of x determines a 
unique value for p*(p), because values at all elements of the 
support are uniquely determined. It cannot be the case that 
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two distinct choices of extended support give different values 
of p*(p), because the union of two extended supports is an 
extended support, and the value computed from the union 
cannot disagree with either of the values computed from the 
original distinct extended supports. 

The function p computed by the procedure above clearly has 
the action on atoms of an allowable permutation satisfying the 
indicated conditions. If there were two distinct allowable per¬ 
mutations pi. p 2 satisfying the given conditions, there would 
be a <aii-first value x at which they disagreed: this value is 
clearly not an atom or a litter with atomic parent, and almost 
as clearly not a litter with set parent, by considering the iden¬ 
tical action of pi and p 2 on the support of the parent of such a 
litter and the fact that p± and p 2 have no exceptions at which 
they can disagree (all exceptions of either map being in the 
domain of p 0 ). 

Note that the value of p computed at an object is completely 
determined by the values of p 0 at atoms (regular and irregular) 
occurring in the given extended strong support of the object 
(in the case of irregular atoms, occurring as parents of litters 
in the extended strong support), along with the maps Pl,m 
fixed in advance. 

limit stages: When a is limit, we define n Q as (J /3<tv fl^. The only induc¬ 
tion hypotheses which require much attention at the limit stages are 
induction hypothesis 1 and the extension property, most conveniently 
discussed below after the verification at successor stages is described. 

successor stage introduced: Now suppose that a — (3 + 1. 

We have already constructed IIg by the hypothesis of the recursion. 

the first approximation Id* to fl a : We first construct an initial approxi¬ 
mation to fI Q , which we call fd^,. 

Choose a Injection erg whose domain is the set of all atoms in the 
transitive closure of Id/g, sending parents[0] to junk, and sending each 
litters [A] to litters [{/?} U A], where /? dominates all elements of A 
(that is, sending clan[yl] to clan[{/3} U A] in a way which preserves 
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the litter structure). Define fix on the range of Ilg by fix(.x,A) = 
(x,{/3}UA). 

Define II* as IIg U <7g(fix o IIg), where the action of erg on a set whose 
transitive closure includes no atom not in the domain of erg is defined by 
the rule <Jp(A) = erg “A Notice that II* is best understood as consisting 
of two isomorphic copies of Ilg. It satisfies all the conditions on parent 
sets of clans except that parents [{/?}] is a new set junk of p irregular 
atoms (already provided earlier: we will see that the same set can be 
used at each successor stage, because junk is purged from the transitive 
closure of II Q ). 

It is important to notice that the symmetric sets in any V™(c±a.n[B]) 
with max(S) < /3, with the symmetry defined in the sense of 11*, are ex¬ 
actly the symmetric sets in ^"(clan [B]), with the symmetry defined in 
the sense of Ilg, and the symmetric sets in 'P”(clan[{ ( d} US]), with the 
symmetry defined in the sense of II*, are exactly the images under <jg of 
symmetric sets in ^"(clan [B]) with the symmetry defined in the sense 
of Ilg. This holds because the actions possible for allowable permuta¬ 
tions on 'P”(clan[{ ( d} U B ]) are exactly those which are analogous to 
actions on 'P"(clan[.E>]) via the action of erg extended to sets, and also 
because the action of allowable permutations on clans included in the 
transitive closure of Ilg and on clans included in the transitive closure 
of erg(fixollg) are completely independent of one another, as no atom 
appearing in the transitive closure of one of these sets appears in the 
transitive closure of the other. In symbols, the allowable permutations 
in the sense of 11^ are exactly the permutations pi U erg/^erg 1 , where 
pi and p -2 are any independently chosen allowable permutations in the 
sense of Ilg [here we regard an allowable permutation in the sense of 
ni, 1) as determined by its restriction to atoms in the transitive closure 
of n^]. 

the construction of II a by repairing(?) the parent set of clan({/3}): 

What we do next is repair II* so that clan[{/?}] has the intended parent 
set 


clan[0] U IJ pfl-IWI+^dan [B]) 

s«{/3} 
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which we will call ff Q . The symmetric power set here is defined in terms 
of Hi 

The preceding expression simplifies to 

£} a = clan[0] U V[ B /cla.n[B]) 

The set component of this is externally isomorphic (via application of 
op) to 


U Pf l+ ‘(clan[iJ]) : 

ma x(B)</3 


1J Pl B ' +1 (clan[B]) 

\m&x(B)<(3 

= U -Pl^fclanlBUOTl) 

ma x(B)</3 

= 1J Pf'(clan[B]), 

(the last step being a reindexing, replacing references to B with refer¬ 
ences to B U {/?}), 

which is entirely describable in terms of the symmetry already com¬ 
puted from U p . It should be clear that the definition of this last set is 
unaffected by the choice of Up or II* as one’s working parent function 
(approximation to II). 

Our intention is to define II a as agreeing with II* everywhere except on 
local cardinals of litters included in clan[{/3}]: these local cardinals will 
instead be mapped bijectively to Q q (which we should recall is defined 
in terms of symmetric power sets in terms of 11^). For this to work, we 
need to show that is of cardinality no greater than (it is clearly 
of cardinality at least /i). We also need to exercise some care with 
regard to the details of the bijection from local cardinals of elements 
of clan[{/3}] to the complex parent set. Notice that the additional set 
of atoms junk used as parents[{/?}] in 11^ disappears completely from 



Version of 1/2/2017 3:30 PM Boise time: version to be submitted 


35 


U a (so we can actually use the same collection of additional atoms at 
each successor stage). 

To be more exact, let h be a Injection from crp “parents[0] = junk to 
f 2 a [we have not forgotten that we need to show that these two sets are 
of the same cardinality //: this is attended to below] and define II a ([A r ]) 
as (/i(7Ti(n^([iV])), {/5}) if N C clan[{/5}] and as n^QiV]) otherwise. 

To arrange for every set to have an extended strong support in the sense 
of U a requires that we pay a little extra attention to how h is chosen. 
The requirement is that we start with a well-ordering (for which we 
will have an occasion to use a name </) of crp “parents [0] = junk 
(hereinafter “the domain”) and a well-ordering of 

Q a = clan[0] U V[ B /cla.n[B]) 

(hereinafter “the range”), both of order type fi, then proceed to define 
h in steps indexed by the ordinals below p,, at each step choosing the 
image under h of the first unused element x of the domain to be the 
first unused element of the range which has an extended strong support 
which does not include any litter with an irregular atom z /u, x as 
parent. We can be sure that h thus defined will include all of its 
intended range because fi has cohnality > k. 

motivational remark: It is useful to note for motivation that the 
effect of replacing junk with as parents [{/?}] is to remove some 
allowable permutations of parents [{/?}] and so possibly to add sets to 
each ^(clanfj^}]). Further analysis will reveal that the effect is to 
add sets to 'P”(clan[.B]) when max (2?) = f3 and n > \B\, and not to 
add any sets to iterated power sets of clans with lower index. 

combinatorics of power sets of clans We show that the symmetric power 
set of any clan is exactly the collection of sets which have small sym¬ 
metric difference from a small or co-small union of litters. 

Suppose X is a symmetric subset of cl an [A]. Let S be an extended 
strong support of X. 

Let L be a litter. Suppose L D X and L \ X are both large. Choose 
a, b belonging to L fl X and L \ X which are not elements of S. There 
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is a locally small bijection which swaps a, b, and fixes each atom be¬ 
longing to S and each irregular atom. A substitution extension of this 
locally small bijection, that is, an allowable permutation extending the 
locally small bijection and with no exceptions outside the domain of 
the locally small bijection, will fix each element of S because if it did 
not, there would be a first element in the order on S which was moved, 
and it would be a litter, and its parent would not be moved, so the 
litter would have to have an exception of the permutation or an image 
of an exception among its elements, which would have to be a or b, 
and a, b are not moved out of the litter to which they belong by this 
permutation. So this map cannot move X because it fixes all elements 
of its support, but also clearly moves X. This contradiction shows that 
no symmetric set can cut a litter into two large parts. 

Suppose X cuts each of a large collection of litters. Let S be an ex¬ 
tended strong support for X. Choose a litter L which does not belong 
to S and contains no element of S and is cut by X. Choose a G L fl X 
and b e L\ X. Consider the locally small bijection interchanging a, b 
and fixing each atom in S and irregular atom. The argument that an 
allowable permutation extending this locally small bijection (with no 
exceptions outside the domain of the locally small bijection) both fixes 
and does not fix X goes exactly as in the previous paragraph. Thus 
any symmetric subset X of a clan has small symmetric difference from 
a union of litters. 

Now suppose that X includes the union of a large collection of litters 
and fails to meet the union of another large collection of litters. Choose 
litters L included in X and M not meeting X , neither belonging to the 
extended strong support S of X. Choose a G L and b e M, neither 
belonging to S. Now extend the locally small bijection interchanging 
a and b and fixing each atom in S and irregular atom to an allowable 
permutation with no exceptions outside the domain of the locally small 
bijection. Suppose this moves any element of S: the first element in the 
sense of <5 which is moved must be a litter, its parent must be fixed, 
so the litter must include an exception or an image of an exception of 
the map which is moved by the map. But the only exceptions of the 
map which are moved (and the only images of such exceptions) are a, b, 
which belong to litters which are not in S. Thus X is fixed. And yet of 
course the map moves X. This contradiction completes the proof that 
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any symmetric subset of a clan has small symmetric difference from a 
small or co-small union of litters. 

Further, it is obvious that any subset of a clan with small symmetric 
difference from a small or co-small union of litters is actually symmetric. 

Clan subset support lemma: If S' is a strong support of an element 
Z of P(clan [B]) then Z is expressible as the symmetric difference 
of a set X C S of atoms and the union or the complement of the 
union of a set Y C S of near-litters. 

Proof of lemma: Let S' be a strong support of an element Z of V(cla.n[B}), 
which is the symmetric difference of a small set X' of atoms and 
either the union or the complement of the union of a small set Y' 
of litters by results shown above. 

For an allowable permutation p to fix Z. it is sufficient for p to be 
a substitution extension of a locally small Injection po fixing each 
atomic element of S' and atomic parent of an element of S', assign¬ 
ing values to each anomaly of an element of S', and compatible 
with fixing each near-litter N in S' in the sense that for each x in 
the domain of p 0 , Po(x) G IV -B- x G N: suppose that such a map 
moved Z: consider the <s-first element u which it moves, which 
must be a near-litter in S': the parent of this near-litter is fixed 
because it has a support consisting of things appearing earlier in 
<g] so some element of u is mapped to a non-element of u or vice 
versa: neither this element nor its image can be an anomaly of u, 
so this element must be an exception of p, and p has no exceptions 
which it moves in a way not compatible with fixing a near-litter 
in S'. 

Suppose that x G X' \ S. Let y / x belong to any near-litter 
in S' which contains x (there might not be such a near-litter, in 
which case y is chosen not to belong to any near-litter in S') with 
y / X' and y / S: a substitution extension of the map fixing 
all atoms which belong to S' or are parents of near-litters in S' or 
are anomalies of near-litters in S' (other than x or y if either of 
them happens to be such an anomaly) and in addition swapping 
x and y fixes Z by considerations above, but at the same time 
clearly moves Z (it is worth noting in this connection that x and 
y either both belong to (J Y' or both do not belong to (J Y '); this 
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contradiction shows that all elements of X' belong to S. 

Suppose that (J Y' is not included in the union of a collection 
X\ C S of atoms and the set union of a collection Fj C S of 
near-litters. This implies that we can find z G (J Y' which does 
not belong to S (and so does not belong to X') and belongs to 
a near-litter which does not belong to S. Find w / [J Y' which 
does not belong to S (and so not to X') nor to any near-litter in 
S] a substitution extension of the map which fixes each atom in 
S, atomic parent of an element of S, anomaly of an element of S 
(other than z or w if either happens to be such an anomaly), and 
in addition swaps z and w will again both move and not move 
Z, so the union of Y' is in fact included in a set X\ U |J Y\ with 
X\ C S a set of atoms and Y\ C S a set of near-litters. We 
may obviously further stipulate that each element of Y\ has large 
intersection with (J Y'\ if an element of Y\ does not meet (J Y', 
we may omit it; if it has small intersection with (J Y', we can omit 
it and add the elements of the small intersection to X\\ Y\ can 
simply be taken to be the collection of near-litter elements of S 
with large intersection with (J Y'. 

Now suppose that the set X\ U |J Y\ which we just constructed 
as covering (J Y' contains an atom z not in S (and so not in X', 
and not in X\, so belonging to some element of Fj) nor in (J Y'. 
Choose an atom w in the same near-litter in Fj C S to which z 
belongs, belonging to (J Y' (recalling that all elements of Fj meet 
IJW) but not belonging to S (and so not to X'). A substitution 
extension of the locally small Injection exchanging z and w, fixing 
all other anomalies of elements of S, and fixing all atoms in S 
and atomic parents of near-litters in S will both move and not 
move Z by considerations now familiar. We have shown that all 
anomalies of the near-litters belonging to Y j which do not belong 
to (J Y' belong to S. 

It follows that Z is the symmetric difference of a set X C S of 
atoms and the union (or the complement of the union) of a set 

Y C S of near-litters: Z clearly has small symmetric difference X 
from either the union or the complement of the union of the set 

Y = Y\ of all near-litters in S which have large intersection with 
(J Y', and all elements of the symmetric difference X are elements 
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of 

the external size of iterated power sets of clans (analysis of orbits) 

It is important to note (to appreciate that the induction is sound) that 
we are in this analysis only considering symmetries in the sense of II*, 
as these are the only symmetries which enter into defining the set 
which we are concerned to show to be of size p. These symmetries 
have nice properties following directly from our induction hypotheses 
and the fact that II* is basically the disjoint union of two isomorphic 
copies of % 

We argue that iP”(clan [B]) is of size p for each B, n < \B\ + 1. This is 
certainly true for n — 0. The results above on the extent of symmetric 
power sets of clans show that this is true for n — 1 : any clan clearly 
has exactly p subsets with small symmetric difference from small or 
co-small unions of litters. 

We recall that we refer to strong supports of elements of a P” +1 (clan [B]) 
satisfying the restriction that their elements belong only to clan[C]’s 
and litters[Cj’s with C<V_B n , guaranteed to exist by inductive hy¬ 
pothesis, as “relevant supports”. We further recall that a relevant 
support of an element of Vb (the only kind of object which can belong 
to more than one iterated power set of a clan) is empty. 

For any object x with relevant support S with order <s, notice that 
p(x ) will have relevant support p(S ) with order p(<g). The conditions 
on a relevant support are invariant under application of an allowable 
permutation. We can then note that we can define a function Xx,s such 
that Xx,s(p(<s)) — p ( x ) f° r each allowable permutation p. To see that 
this is true, note that if p(<s) = p'{<s), we must have p(x) = p'(x), 
because p' o p -1 will fix every element of the support of x. We call the 
functions Xx,s “coding functions”: ranges of coding functions are orbits 
under the allowable permutations. 

We argue that there are < p coding functions with range included in 
each 'P n+ 1 (clan[T>]), where n < \B\. 

We define the complexity of a power set V' 1+1 (c±a.n[B]) as the minimum 
element of B n , or A if B n is empty. The complexity of a coding function 
is defined as the smallest complexity of a 'P n+ 1 (clan[F>]) which includes 
its range (there is only one such iterated power set unless the coding 
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function is one whose sole value is a hereditarily finite pure set). Note 
that the complexity of an iterated power set of a clan which includes 
the parent of an element of litters [A] [other than a parent which 
happens to be a hereditarily finite pure set], that is, the complexity 
of a pl B l _ l j 4 l+ 1 (clan[i?]), is the minimum element of B\b\-\a\ — A. In 
the odd case where the parent is a hereditarily finite pure set, the 
complexity will be less than or equal to the minimum element of A. 

Observe that the domain of a coding function is the orbit under the 
allowable permutations of a relevant support order < 5 . We can char¬ 
acterize all such orbits by a stereotyped set of information. 

Definition (orbit specification): The orbit specification of <5 is de¬ 
fined as the function which takes each 7 less than the order type 
of <5 to a tuple consisting of the following components: 

1. The first component is 0 if »S ' 7 is an atom, 1 if Sb is a near¬ 
litter. 

2. The second component is the index of the clan of which Sb is 
an element or subset. 

3. The third component is the index 5 of the Ss of which fit, (an 
atom) is an element, if there is one, and otherwise is n. 

4. The fourth component, in case Sb is a near-litter and the 
parent of S 1 is a set, is the coding function g 7 such that the 
parent of S 7 is SbQCsh), where [<s ] 7 is the restriction of 
the initial segment of <5 of order type 7 to clans clan[C] 
and litter sets litters [C] for C<VB ni where the parent of 
Sj belongs to 7 ?n+1 (clan[i?]) [empty if the parent of <S 7 is a 
hereditarily finite pure set], and otherwise is 1 . 

5. The fifth component, in case fit, is a near-litter and the parent 
of S 7 is an atom, is the index 5 of the atom Ss which is the 
parent of S 7 , if there is one, and otherwise is k. 

Note that a coding function appearing in the specification of the orbit 
of an order <5 which is a relevant strong support for an element of 
a set 'P n+ 1 (clan[bl]) where n < \A\ will either be of lower complexity 
than 7 7 n+ 1 (clan[ll]) or will be of the same complexity but with domain 
elements of order type smaller than the order type of < 5 . 
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We need to establish that orbit specifications indeed specify orbits in 
orders on support sets. It should be clear that if p is an allowable 
permutation, p(<s) has the same orbit specification as <$■ The con¬ 
siderations in point 6 a under the inductive hypotheses can be used to 
show that if <5 and <t have the same orbit specification, there is an 
allowable permutation p such that p(<s) — <t- The only interesting 
case is the case in which 5 7 and T 1 are near-litters and have set parents: 
their respective parents are then of the form < 7 7 ([<s] 7 ) and <? 7 ([<t] 7 ), 
where g 7 is a coding function - so if we have already defined a locally 
small bijection with substitution extension sending each S$ to T$ for 
5 < 7 and so sending [<s ] 7 to [<r] 7 , its substitution extensions will 
send the parent of <S ' 7 to the parent of T 7 , and we can then arrange to 
send ,S 7 to T 1 as described in the proof of point 6 a under the inductive 
hypotheses. We have indicated the verification that orbit specifications 
indeed specify orbits. 

We now present the argument for limited size of sets of coding func¬ 
tions. The goal to be proved is that there are < p coding functions 
with range T ,n+1 (clan [B]) acting on relevant supports whose associated 
orders have any fixed order type 7 < k on the hypothesis that there 
are < p coding functions with any range which either have smaller 
complexity or have the same complexity but act on support orders of 
length less than 7 [once we have shown this we will have shown that 
there are < p coding functions with this range independently of the 
order type of their domain elements] . 

On the inductive hypotheses, there will be < p specifications for or¬ 
bits of support orders of length < 7 which can be relevant supports 
of elements of 'P n+ 1 (clan[i?]), because all coding functions appearing 
in such specifications will either be of lower complexity than that of 
'P" + 1 (clan[i?]) or of the same complexity but having domain elements 
of length < 7 , and orbit specifications are otherwise rather small ob¬ 
jects (lists of data of length < k). 

If n = 0, the value of any such coding function will be determined as 
the symmetric difference of atoms in certain positions in the support 
order input and either the union of near-litters at certain positions in 
the support order input or the complement of the union of near-litters 
at certain support order positions, by the Clan Subset Support Lemma. 
For each of < p possible specifications of the orbit in which the support 
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order input lies, we have no more than 2 K possible coding functions, for 
a total of < /i coding functions in this case. 

It remains to consider the case n > 0. 

We demonstrate that a coding function x is completely determined 
by a specification of the orbit which is its domain and a set of cod¬ 
ing functions of lower complexity: let x be an element of the range 
P" +1 (clan [B]) of x (where 0 < n < \B\), with x = x(<s) (so of course 
S is a relevant support for x). For each y G x, choose a relevant strong 
support T so that T end extends the appropriate restriction of <5 (re¬ 
move from <s those items not taken from a clan[C] or litters [C] 
with C equal to or downward extending the order <t on the 

support T chosen for a y £ x will be an end extension of this restric¬ 
tion). This yields a set of coding functions for elements y of x, all of 
complexity the minimum of B n _ 1 , so less than the complexity of y, the 
minimum of B n . 

We claim that this set of coding functions along with <5 determines 
x and so x exactly: we claim that x is exactly the set of all Xv,t(<t') 
where <t' end extends the appropriate restriction of < 5 . Every element 
of x is of the form Xv,t(<t), of course: but further, Xv,t{<t') belongs 
to x, too, because we can construct (by the methods of point 6 a under 
the inductive hypotheses) a locally small Injection which adjusts <t 
to <t' and in addition fixes all elements of the domain of <5 (noting 
that <s U <t and <5 U <t> can be extended to orders on strong 
supports with the correct relationship to one another), and an allowable 
permutation extending this will send y = Xv,t(<t) which is in x to 
Xv,t{<t ')> and will fix x by support considerations, so Xy,r{<T') G x as 
well. And further, this procedure will work to compute the value of x at 
any < 5 / in its domain, since everything in sight commutes with uniform 
application of an allowable permutation: so x is exactly specified by 
the orbit of <5 and the collection of functions Xy,T- 

Now a coding function Xx,s acting on support orders of length 7 and 
with range in "P n+1 (clan[5]) (n > 0) is seen to be determined by one 
of < ji possible specifications for the orbit in support orders which is its 
domain, and a subset of the set of coding functions of lower complexity 
(the set of coding functions of lower complexity is of cardinality < //; 
and this set has < y subsets because /i is strong limit) so there are < /j 
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such coding functions, and further it follows immediately that there are 
< fi coding functions with this range. 

The application of < /x coding functions with range V n+1 (c±a.n[B}) to 
p orders on strong supports will generate no more than p elements in 
the iterated symmetric power set "P" +1 (clan[.B]), and this is sufficient 
to see that the set is of cardinality no more than p (and in fact 
exactly p because it includes a clan). 

verification of the extension property and induction hypothesis 1: 

We demonstrate the extension property for n*. Suppose that p 0 is a 
locally small Injection acting on atoms in the closure of II) t . Let f)\ be 
the restriction of p 0 to atoms in the transitive closure of Ilg and let p 2 
be the restriction of p 0 to the transitive closure of II* \ 11/3. Let p' 0 be a 
substitution extension of p\ in the sense of Ilg, and let p' 2 be a substitu¬ 
tion extension of cr/ 1 p20'p in the sense of 11/3. The map p\ U opp ^cr/ 1 is 
readily seen to be a substitution extension of p 0 . Here we are exploiting 
the fact that n* is in effect the disjoint union of two copies of n^. 

We state the conditions relating allowability of a permutation in the 
sense of n* and in the sense of n Q . If p is allowable in the sense of 
n Q , it is readily extended to junk in such a way as to be allowable in 
the sense of n^: for x in junk, define p(x) as h~ l (p{h(x))). We will 
refer to this result informally in the terms “a permutation allowable 
in the sense of n o is allowable in the sense of n^”. A permutation p 
which is allowable in the sense of is allowable in the sense of n a 
[after disregarding its values on junk, which is not in the transitive 
closure of n a ] iff it satisfies the condition p(h(x)) = h(p(x)) [which is 
of course a restrictive condition on how it acts on junk]. The issue in 
both cases is that the difference between n* and n Q has precisely to do 
with replacing the parent x G junk of each litter included in clan[{/5}] 
with h(x) E ff Q . 

We prove an 

Extension Lemma: Let po be an allowable permutation in the sense 
of Bp (considered as implemented as a map on the atoms in the 
transitive closure of n^) and let p\ be a locally small Injection on 
atoms in the transitive closure of n a \ n^, agreeing with p 0 where 
their domains intersect (which will be in parents[0] and clan[0] 
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only). Then there is an allowable permutation p which extends 
po, extends pi, and has no exceptions other than exceptions of p 0 
and elements of the domain of p\. 

Proof of Extension Lemma: Notice that p\ has no action on junk. 
We will define a map p 2 on junk. 

Fix maps Pl,m-> bijections from L\dom(pi) to M\dom(pi), for each 
pair of litters L, M in the same clan with index whose maximum 

is (3. 

For each x such that h(x) G clan[0], we define p 2 (x) as /i _1 (p 0 (/i(x))) 
We define all other values of p 2 by recursion along the order < h 
used in the construction of h above. Suppose that x is the < h - 
least element of junk at which p 2 is not yet defined. Let p x be a 
substitution extension in the sense of fl^ of the union of the part of 
p 2 already defined and the locally small Injection p 1 , also agreeing 
with each map Pl, Px (l)°' the construction of such a map p x is 
described under point 6b under the inductive hypotheses. The 
value p x (h(x)) is uniquely determined (it is not affected by the 
arbitrary assignment of values of p x to elements of junk for which 
p 2 has not yet been defined), because h(x) has a strong support in 
which any irregular atoms that occur as parents of litters already 
have p 2 defined, by the construction of h. We define p 2 (x) as 
h~ l (p x (h(x)). We iterate this until p 2 is defined on all of junk, 
then take p to be the union of p\ and the unique (on atoms in 
the transitive closure of IIq, \ lip) substitution extension of p 2 U p\ 
which extends each Pl, p (l)°- If we disregard the action of this p 
on junk, it satisfies the conditions to be allowable on fl a , and it 
clearly has only the exceptions indicated. 

We can use the Extension Lemma to verify the extension property in 
the sense of IIq,: if po is a locally small Injection in the sense of fl a , 
let p\ be a substitution extension in the sense of lip of the restriction 
of po to the transitive closure of lip, and let p 2 be the restriction of p 0 
to the transitive closure of II a \ lip. The maps pi and p 2 satisfy the 
hypotheses of the Extension Lemma, and the extension of these maps 
obtained will be a substitution extension of the original po- 

We can use the Extension Lemma to verify induction hypothesis 1. The 
action of an allowable permutation in the sense of !!„ on the atoms in 
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the transitive closure of lip is allowable in the sense of Lip. To show 
that the symmetry on iterated power sets of clans whose index has 
maximum < f3 is the same in the senses of the two parent functions, we 
also need to show that any allowable permutation in the sense of Lip 
extends to an allowable permutation in the sense of n^. This follows 
from the Extension Lemma: take p 0 to be any allowable permutation in 
the sense of lip, take p\ to be empty, and apply the Extension Lemma 
to get the desired extension. 

Finally we comment that the extension property can be seen to hold 
at limit stages as well: let po be a locally small bijection in the sense 
of a IIa whose domain includes all irregular atoms. We can extend 
successively larger restrictions of p 0 to successive II a ’s for a < A, ap¬ 
plying the successor stage construction at successors and taking unions 
at limits (we can use the extension lemma to ensure that the successive 
approximations that we construct are nested), until the extension of 
the full po to IIa is obtained. Similar considerations apply to induction 
hypothesis 1. 

the need to preserve notions of symmetry: To establish that the de¬ 
sired formula for parent sets continues to hold at A = {/3} we need 
to show that the iterated symmetric power sets appearing in the def¬ 
inition of the complex parent set have the same extension when IIq, 
is used to define allowable permutations in place of II*: we will ar¬ 
gue that the definition of 'P"(clan[f?]) for n < \B\,B <C {/} using 
n Q as the parent function agrees with the definition of 'P"(clan[f3]) 
for n < \B\,B <C {/} using LI* as the parent function. This is also 
needed to verify the induction hypothesis on existence of external iso¬ 
morphisms, and to verify the inductive hypothesis concerning the exis¬ 
tence of relevant supports. 

the argument for preservation of notions of symmetry: We show by 
induction on n that 'P”(clan[.E>]) has the same extension for each n 
with 1 < n < \B\ in terms of II a as in terms of II*. 

basis step: This result for n = 1 follows from the results on the extent 
of symmetric power sets of clans: these are uniquely specified in a 
way quite independent of the details of the parent function used. 
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induction step: We now argue that if "P"(clan [B]) has the same ex¬ 
tension in terms of both II ^ and II a , so does 'P” +1 (clan[I3]), where 
1 < n < \B\ and the maximum element of B is fd (where the 
maximum element is not f3 there is no issue, as II Q symmetry is 
evidently the same as big symmetry in this case). One direction of 
this is easy, as all II Q -aIlowable permutations are also Il^-allowable 
permutations, so any object c invariant under all Il^-allowable 
permutations hxing all elements of a support set S is also in¬ 
variant under all n Q -allowable permutations hxing all elements 
of the same support set. So what we actually need to show is 
that a subset X of P"(clan [B]) with a strong support S relative 
to II a -allowable permutations also has support S relative to 11* 
permutations. 

Strong supports exist in the sense of the parent function n a be¬ 
cause of the way h is constructed, which ensures that each of 
the elements of parents[{/5}] (in the sense of IIq,, that is, Hq,) 
has II Q -strong support computable by recursion along <h from its 
Il^-strong support, computed from the big-strong support of its 
preimage under erg, and the II Q -strong supports computed for ele¬ 
ments of parents [{/?}] = considered earlier in the construction 
of h. 

Let p be a Il^-allowable permutation hxing each element of S, 
a II Q -strong support of X C P"(clan[£>]). Let c belong to X. 
The element c has a Ll^-relevant strong support T by inductive 
hypothesis, which is also a II a -strong support for c (to see this, 
observe that any element of T belongs to clan[(7] or litters [C] 
with C <C B n _ i, which has at least two elements: the only way T 
could fail to be II a -strong would be if it contained an element of 
litters[{/3}]). Now extend T to a II a -strong support U including 
S, with associated well-ordering <u- 

Construct a locally small bijection p 0 sending each atom which 
either belongs to U or is the parent of a near-litter belonging to 
U to its image under p, and further ensure that each anomaly of 
an element of U or preimage under p of an anomaly of an element 
of p(U) and each exception of p has the same image under p 0 
that it has under p, and that p 0 respects each near-litter element 
u of U in the sense that po maps elements of u to elements of 
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p(u) and non-elements of u to non-elements of p(u). Choose a 
fI Q -allowablc substitution extension p' of po : f> agrees with p on 
U, at atoms by construction and at near-litters for reasons which 
by now should be familiar: if not, consider the first near-litter 
u £ U such that p(u) / p'[u ); the parents of these two near litters 
are equal because p' is IlN allowable and has the same action on a 
support of the parent as p\ p' must then map some element of u 
to a non-element of p(u) or vice versa, but we have arranged that 
this element is forced to be an exception of p' (by forcing p to 
agree with p' at anomalies of relevant near-litters), and p' has no 
exceptions at which it disagrees with p. Thus p sends each element 
of U to its image under p, and thus fixes X because it fixes all 
elements of S, and satisfies p'(c) = p(c) because p and p' have the 
same values on T, a II a -support for c. Thus p'(c) = p(c) £ X: 
p _1 (c) £ X by an identical argument, so p fixes X, so S is also a 
fl^-support for X. 

preserving external isomorphism conditions and support restrictions: 

Note that we will enforce our inductive hypothesis about existence 
of external isomorphisms between initial segments of natural mod¬ 
els of type theory if the meaning of V * in descriptions of these par¬ 
ent sets is preserved in our passage from fl l a to fl a : op will wit¬ 
ness all these isomorphisms: the default natural model with top type 
■p* +1 (clan[A]) and bottom type cl an [A] (0 < n < |A|)) will be an iso¬ 
morphic copy of the model with top type V n+l (cla.-n.[A\A/\ and bottom 
type cl an [A \ A n ] by application of the isomorphism witnessed by op 
and a finite series of external isomorphisms found at earlier stages, and 
application of the result that notions of symmetry are preserved. 

We need to verify that we have a strong support for any element of a 
'P” +1 (clan [B]) involving clans and near-litters taken from clans with 
index equal to or downward extending B n (a relevant support). For B 
not containing (3, this is direct. For B containing /?, where B n is not 
empty, an element of 'P" +1 (clan[i?]) has a relevant support relative 
to 11/ copied from the relevant support of the analogous object in 
7 :> ” +1 (clan[i?\{/3}]), which is still a support of it relative to fl a because 
the allowable permutations with respect to fI Q are a subset of those 
allowable with respect to 14*. This does depend on the result shown 
above that 'P” +1 (clan[F>]) has no new elements with respect to 44 a 
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(that notions of symmetry are preserved). That we have a relevant 
support for a P” +1 (clan [B]) where f3 G B and B n is empty is evident, 
because relevance is no constraint in this case. 

This completes the proof that the construction of fl (as fix) works. 

Slightly more is needed to complete the main argument. 

cardinalities of subsets of clans: We argue that a symmetric Injection 
between subsets of a clan has small symmetric difference from the iden¬ 
tity map on its domain. Suppose that / is a bijection from X C clan[A] 
to Y C clan [A] with extended strong support S and with large sym¬ 
metric difference from the identity, so there is a large subset X' of 
its domain on which it is not fixed. By earlier results, X' must have 
large intersection with a litter L. Choose elements a, b of L such that 
a,b, f(a), f(b) are all distinct and none of them belong to S (consider 
the fact that orbits in / are small sets). A substitution extension of 
the locally small bijection which exchanges a, b and fixes /(a), f{b) and 
all atoms in S is seen both to fix X and to move it. The substitution 
extension is seen to fix near-litter elements of S by considering the first 
litter in <5 which it moves as in arguments above, noticing that it 
must contain an exception or an image of an exception of the substitu¬ 
tion extension. . .which has no exceptions or images of exceptions which 
belong to litters in S. 

This tells us that the litters have distinct ft-amorphous cardinalities in 
the FM interpretation (a ft-amorphous set being one which has only 
small and co-small subsets, and a ft-amorphous cardinal being the car¬ 
dinality of such a set). 

an important injection: There is a symmetric injection from P* (parents[A]) 
to P*(clan[M]), associating each symmetric subset X of parents[A] 
with the set union of the collection of local cardinals with parents in 
X. This witnesses the important inequality 

|P 2 (clan[A])| > |P*(parents[A])| 

holding in the FM interpretation. We do not actually need the result 
about cardinality just above to show this, as this map is obviously sym¬ 
metric and an injection. The preceding result is a nice result, though, 
and justifies the use of the term “local cardinal”. 
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motivational remark: This situation is a major aim of the elabo¬ 
rate machinery of our construction. The FM interpretation is designed 
so that the power set of a clan is almost amorphous, and its structure 
reveals nothing about the structure of the parent set that the FM inter¬ 
pretation can see, but the double power set of a clan contains structure 
which the FM interpretation can see as parallel to the structure of the 
power set of the parent set (not just the parent set itself!). This is part 
of what enables us to fit the cardinalities of iterated power sets of clans 
together into the unlikely structure of a tangled web. 

The main theorem: We can now prove that the map r on nonempty clan 
indices defined by the equation t(A) = |P 2 (clan[A]| is a tangled web, 
from which the main result of the paper that NF is consistent follows 
at once. 

definition and verification of the tangled web: All cardinality facts men¬ 
tioned here are those of the FM interpretation. 

Define exp(|X|) as \V/X)\. 

We need to verify that exp(r(A)) = t(Ai) if \A\ > 2 This is equivalent 
to showing that |P* (clan[A])| = |P 2 (clan[A x ]) [whence it is straight¬ 
forward to show that |P" +2 (clan[A])| = |P 2 (clan[A n ])| iwhen \A\ > n\. 
We have from the inequality witnessed by the injection described just 
above and the formula for parent sets that 

|f > . 2 ( clan l'4i]) > |'P,(parents[>l 1 ]| 

> |P.fP;- 4| - | - 4ll+1 (clan[>l]))| = |P, 3 (clan[.4])|. 

On the other hand 

|'P*(clan[A])| > |P 2 (parents[A])| > |P 2 (clan[Ai])|. 

This verifies the naturality property of tangled webs. 

The clcmentarity property of tangled webs falls directly out of the con¬ 
struction. We need to show that the first order theory of a natural 
model (all natural models discussed here being those of the FM inter¬ 
pretation) of TST n whose base type has cardinality r(A) depends only 
on A\A n , the set of the smallest n elements of A, where |A| > n. This 
reduces to consideration of default natural models of TST n whose base 
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type is "P* (clan[A]) and whose top type is P™ +1 (clan[A]). This model 
is the image under the action of a bijection on atoms [in the ground 
model of ZFA] of the default natural model of type theory whose base 
type is P^(clan[A\A n ]) and whose top type is P" +1 (clan[A\A n ]), by 
the construction (the construction actually provides an external isomor¬ 
phism between the default natural models of TST n+2 with base types 
clan[A] and clan[A \ A n ], a composition of maps erg): these models 
have the same first-order theory because they are isomorphic models 
of the appropriate initial segment of type theory from the standpoint 
of the ground model of ZFA, so the theory of the model considered 
initially depends only on A \ A n . 

At this point the main result of the paper (the consistency of NF) is 
proved. 

a possible simplication of the formula for parent sets: If we define 
B <Ci A as B <C A A \B\ — \A\ = 1 (in other words, B = A U {/3} for 
some ft dominated by all elements of A), we could carry out the proof 
using the formula (for nonempty clan indices A) 

parents [A] = clan[Ai] U |J ^(clan[B]). 


or equivalently 

parents [A] = clan[Ai] U U PKclMA U {/?}]). 

/3<min(A) 


One can see from the proof just above that this is sufficient to establish 
the naturality property of the tangled web. We have decided not to 
adopt this “simplified” form basically because nothing much is gained 
in terms of complexity of the proof: it is still necessary to show preser¬ 
vation of notions of symmetry for all P"(clan[i?]) with n < \B\ (this n 
does not reduce to 2) because the preservation of symmetry is needed 
to verify the isomorphism conditions as well as the parent set formula. 
It is also the case that this is only nominally less evilly tangled than 
the original formula. 

an outline of an interpretation of tangled type theory: It should be 

noted that the external isomorphisms between iterated power sets in the 
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natural models based on the tangled web are such that various iterated 
power sets can in fact be identified in such a way as to produce a model 
of the tangled type theory TTT\. This is important in connection with 
application of the results indicated in section 6.1, which allow us to 
draw the further conclusion that there is an w-model of NF. We briefly 
indicate how to do this. Our aims here are restricted to a compact 
description of the interpretation and a general description of the reasons 
why it is an interpretation: we feel free to do this as our main result 
does not depend on this; the reason that we discuss it is that it makes 
it easier for us to give an indication of reasons why the existence of an 
cu-model of NF follows from our construction, which is important for 
corollaries mentioned in the conclusions section below. 

Type a for each a < A is conveniently implemented as P 2 (clan({a:}). 
A scheme of bijections E A ^ n : P*(clan([{a}]) — > P" +2 (clan[A]) are 
presented, for each A for which min(A n ) = a. These bijections im¬ 
plement a scheme of identification of each P" +2 (clan[A]) for which 
min(A n ) = a with type a of the interpreted tangled type theory. 

The embedding E{ a y t0 is of course the identity map. 

The embedding A (where a > (3) is in each case a hereditarily 

symmetric Injection from P 2 (clan[{a:}]) to P 3 (clan[{a!, /?}]): we have 
just shown that such bijections exist. 

If the embedding P 4 has been defined, and 5 dominates all members 
of A, we define E^}uA,n( x ) as o’s(E Ajn (x)), noting that E A is already 
known to map P 2 (clan({a:}) to P” +2 (clan[A]), while as [defined in the 
construction above] acts as an isomorphism between natural models of 
initial segments of type theory with clans as base types which (among 
other things) sends P” +2 (clan[A]) to P” +2 (clan[{(5} U A]). 

If E A>n is defined and each element of A dominates 5 , E A u{ 5 },n+i is 
intended to map P 2 (clan[{min(A n )}]) to P n+3 (clan [A U {£}]). Let 
a denote min(A n ) and let /3 denote min(A n _i). We may suppose 
that we have already defined the map F , { q ,/ 3 },i from "Phelan({a}) to 
P 3 (clan[{a, /?}]) and the map £Uu{<5},n from P 2 (clan[{/3}]) to 
P n+2 (clan[AU{5}]). Define E Au{5} ^ n+1 (x) as E Au{ s }) n\a- l {E {a ^ }A (x))). 
The application of a” 1 converts elements of P 3 (clan [{«,/?}] to ele¬ 
ments of P 3 (clan[{/3}]) by the application of an external isomorphism 
(acting on atoms) of a relevant natural model of an initial segment of 
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type theory. 

The crucial feature is that that for any x,y, if Ea,ti( x ) and £U,n+i(?/) 
are defined and Ea'^/x) and EA\ n '+i(y) are defined, then Ea,u( x ) G 
Ea,u+i( y) -H- E\' .n' i x ) *= Ea'ji'+i’- types identified via the scheme of 
bijections agree about membership facts. 

For (3 < a < A, the membership x y of the interpretation of 
tangled type theory whose construction we outline here is defined as 
holding, for x G P* (clan[{/3}]) and y G P* (clan[{a}]), just in case 
E A ,n{x) G EA, n +i(y ) f° r some (and so for any) A such that min(A n ) = 
a,min(A n+ i) = /3: concretely, x G^ y iff E {a ^ }fi (x) G E {a ^ }}1 (y), 
that is, cr a (x) G E{ atl gjj(y). The verification of extensionality and 
comprehension follows in a straightforward manner by considering the 
identifications of the types with suitable segments of natural models of 
type theory (natural models in the sense of the FM interpretation, of 
course). 

It is important to note that the relations G^q. of the interpretation of 
tangled type theory are not set relations in the FM interpretation, be¬ 
cause of the role of the external maps as derived from the construction 
of the FM interpretation in the definition of the bijections generating 
the interpretation of tangled type theory. 
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9 Conclusions and questions 

The conclusions to be drawn about NF are rather unexciting ones. 

By choosing the parameter A to be larger (and so to have stronger parti¬ 
tion properties) one can show the consistency of a hierarchy of extensions of 
NF similar to extensions of NFU known to be consistent: one can replicate 
Jensen’s construction of u- and a-models of NFU to get u- and a-models of 
NF (details given above). One can show the consistency of NF + Rosser’s 
Axiom of Counting (see ro, Henson’s Axiom of Cantorian Sets (see i) , or 
the author’s axioms of Small and Large Ordinals (see [6], [7]. [15] ) in basically 
the same way as in NFU. 

It seems clear that this argument, suitably refined, shows that the consis¬ 
tency strength of NF is exactly the minimum possible on previous informa¬ 
tion, that of TST + Infinity, or Mac Lane set theory (Zermelo set theory with 
comprehension restricted to bounded formulas). Actually showing that the 
consistency strength is the very lowest possible might be technically tricky, 
of course. We have not been concerned to do this here. It is clear from what 
is done here that NF is much weaker than ZFC. 

By choosing the parameter k to be large enough, one can get local ver¬ 
sions of Choice for sets as large as desired, using the fact that any small 
subset of a type of the structure is symmetric. The minimum value u\ for k 
already enforces Denumerable Choice (Rosser’s assumption in his book) or 
Dependent Choices. It is unclear whether one can get a linear order on the 
universe or the Prime Ideal Theorem: that would require major changes in 
this construction. But certainly the question of whether NF has interesting 
consequences for familiar mathematical structures such as the continuum is 
answered in the negative: set k large enough and what our model of NF 
will say about such a structure will be entirely in accordance with what our 
original model of ZFC said. It is worth noting that the models of NF that 
we obtain are not ^-complete in the sense of containing every subset of their 
domains of size k; it is well-known that a model of NF cannot contain all 
countable subsets of its domain. But the models of TST from which its 
theory is constructed will be ^-complete, so combinatorial consequences of 
^-completeness expressible in stratified terms will hold in the model of NF 
(which could further be made a n -model by making A large enough). 

The question of Maurice Boffa as to whether there is an cj-model of TNT 
(the theory of negative types, that is TST with all integers as types, proposed 
by Hao Wang ([IB])) is settled: an w-model of NF yields an u -model of TNT 
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instantly. This work does not answer the question, very interesting to the 
author, of whether there is a model of TNT in which every set is symmetric 
under permutations of some lower type. 

The question of the possibility of cardinals of infinite Specker rank (at 
least in ZFA) is answered, and we see that the existence of such cardinals 
doesn’t require much consistency strength. For those not familiar with this 
question, the Specker tree of a cardinal is the tree with that cardinal at the 
top and the children of each node (a cardinal) being its preimages under 
a i—^2". ft is a theorem of Forster (a corollary of a well known theorem of 
Sierpinski) that the Specker tree of a cardinal is well-founded (see [2j, p. 48), 
so has an ordinal rank, which we call the Specker rank of the cardinal. NF + 
Rosser’s Axiom of Counting proves that the Specker rank of the cardinality of 
the universe is infinite; it was unknown until this point whether the existence 
of a cardinal of infinite Specker rank was consistent with any set theory in 
which we had confidence. The possibility of a cardinal of infinite Specker 
rank in ZFA is established by the construction here; we are confident that 
standard methods of transfer of results obtained from FM constructions in 
ZFA to ZF will apply to show that cardinals of infinite Specker rank are 
possible in ZF. 

This work does not answer the question as to whether NF proves the 
existence of infinitely many infinite cardinals (discussed in [2J, p. 52). A 
model with only finitely many infinite cardinals would have to be constructed 
in a totally different way. We conjecture on the basis of our work here that 
NF probably does prove the existence of infinitely many infinite cardinals, 
though without knowing what a proof will look like. 

A natural general question which arises is, to what extent are all models 
of NF like the ones indirectly shown to exist here? Do any of the features of 
this construction reflect facts about the universe of NF which we have not 
yet proved as theorems, or are there quite different models of NF as well? 
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